In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure… (CVE-2026-98964)

The Linux kernel nvmet subsystem had a flaw in nvmet_req_alloc_p2pmem_sgls() where req->p2p_dev was assigned only after both data and metadata scatter-gather list (SGL) allocations succeeded. If data allocation succeeded but metadata allocation failed, the cleanup function out_free_sg called pci_p2pmem_free_sgl() with an uninitialized req->p2p_dev pointer. The fix involves passing the local p2p_dev argument directly to the cleanup function to ensure the same PCI device used in the successful data allocation is used during cleanup, preventing use of an uninitialized pointer.

This vulnerability could lead to improper cleanup of PCI P2P memory resources during metadata allocation failure in the nvmet subsystem. While no direct exploitation details or CVSS score are provided, the issue may cause kernel instability or resource mismanagement.

A fix has been implemented in the Linux kernel to address this issue by correcting the device pointer usage during cleanup. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.